A wiered IP address from a phishing message

 

Days ago I got a short message as above picture. The URL looks wiered at firt glance. However, it did work! So what does the number 3188598201 mean?

Based on RFCs, DNS host names must start with a letter, NOT a number. So, it is NOT a host name.

Then, the only possibility is 3188598201 is an IP address. But for me it's a completely new textual representation format.

It's not hard to recognize that 3188598201 is the unsigned interger value of that more readable IP address shown on the browser, 190.14.37.185.

3188598201 = byte [185, 37, 14, 190]

Now we know it works, but is this format a standard?

After some research(googling), I found an expired draft at https://datatracker.ietf.org/doc/html/draft-main-ipaddr-text-rep-00#ref-MTP.

Based on this doc, this IP v4 address format  as a whole number is supported widely but NOT a standard! Most people use it for hiding their real IP address, just like the short message I got.

The man page of inet_aton gives more details and more IP v4 address formats supported by this API.

Below is my C code to translate dotted IP address format to the whole number format.

$ cat ip_as_int32.c
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv){
        if(argc != 2){
                printf("Usage: %s xxx.xxx.xxx.xxx\n", argv[0]);
                return 1;
        }
        unsigned char ip[4] = {1,0,0,127};
        char* p = &argv[1][0];
        char d[4];
        int i=0;
        int k=0;
        while(1){
                if(*(p+1) == '\0'){
                        d[i] = *p;
                        d[i+1] = '\0';
                        ip[3-(k++)] = (unsigned char)atoi(d);
                        break;
                }
                if(*p == '.'){
                        d[i] = '\0';
                        ip[3-(k++)] = (unsigned char)atoi(d);
                        i=0;
                        p++;
                        continue;
                }
                d[i] = *p;
                p++;
                i++;
        }
        unsigned int ipInt = *((unsigned int*)ip);
        printf("%u.%u.%u.%u = %u\n", ip[3], ip[2], ip[1], ip[0], ipInt);
}

e.g.

$ ./ip_as_int32 190.14.37.185
190.14.37.185 = 3188598201

Merry Christmas and Happy new year 2023!